From e1ff960c9407f0b00a0477b2cd2f0a34281f3549 Mon Sep 17 00:00:00 2001
From: Mark Nielsen <mark@moodlerooms.com>
Date: Tue, 30 Jul 2013 08:44:01 -0700
Subject: [PATCH] MDL-39090: Duplicate parameters in LTI launches

Removed endpoint query string params from body
to prevent param duplication.
---
 mod/lti/locallib.php | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/mod/lti/locallib.php b/mod/lti/locallib.php
index d54ab6627cf..e14102fd902 100644
--- a/mod/lti/locallib.php
+++ b/mod/lti/locallib.php
@@ -176,6 +176,19 @@ function lti_view($instance) {
 
     if (!empty($key) && !empty($secret)) {
         $parms = lti_sign_parameters($requestparams, $endpoint, "POST", $key, $secret);
+
+        $endpointurl = new moodle_url($endpoint);
+        $endpointparams = $endpointurl->params();
+
+        // Strip querystring params in endpoint url from $parms to avoid duplication.
+        if (!empty($endpointparams) && !empty($parms)) {
+            foreach (array_keys($endpointparams) as $paramname) {
+                if (isset($parms[$paramname])) {
+                    unset($parms[$paramname]);
+                }
+            }
+        }
+
     } else {
         //If no key and secret, do the launch unsigned.
         $parms = $requestparams;